MailEnable < 1.7 IMAP Server Multiple Vulnerabilities (ME-100008)

high Nessus Plugin ID 20226

Language:

Synopsis

The remote IMAP server is affected by buffer overflow and directory traversal vulnerabilities.

Description

The remote host is running MailEnable, a commercial mail server for Windows.

The IMAP server bundled with the version of MailEnable Professional or Enterprise Edition installed on the remote host is prone to a stack-based buffer overflow when handling an overly-long mailbox name in certain commands. An authenticated attacker may be able to leverage this issue to execute arbitrary code remotely as the SYSTEM user.

It also fails to filter directory traversal sequences from mailbox names passed to the 'CREATE' and 'RENAME' commands. An authenticated attacker can exploit these issues to create arbitrary directories on the affected host and to cause a denial of service by renaming the mail directories of other users.

Solution

Upgrade to MailEnable Professional 1.7 or later. Or apply ME-100008, the IMAP Cumulative Hotfix dated November 18th, 2005, referenced in the vendor URL above.

Plugin Details

Severity: High

ID: 20226

File Name: mailenable_imap_17.nasl

Version: 1.19

Type: remote

Agent: windows

Family: Windows

Published: 11/20/2005

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:mailenable:mailenable

Required KB Items: imap/login, imap/password

Excluded KB Items: imap/false_imap, imap/overflow

Exploit Ease: No known exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 11/18/2005

Reference Information

CVE: CVE-2005-3690, CVE-2005-3691

BID: 15492, 15494

Detections

Analytics